Resources/namespace assign from one to another tennant

[msergg]

Where can I find description or some docs
how to assign to existing namespaces without tenant or migrate to another tenant?

Adding label capsule.clastix.io/tenant: <tennant> is not working
Cant figure out what I messed

Thanks for support

[msergg]

look like need to add block, is it?

 ownerReferences:
    - apiVersion: capsule.clastix.io/v1beta2
      kind: Tenant
      name: test-team
      uid: 1b17fb95-b49b-4b77-925a-771b6fff41ab
      controller: true
      blockOwnerDeletion: true

[prometherion]

Yes, it is: thanks to the OwnerReference Capsule can detect that change and starts the reconciliation for the required objects.

The annoying thing is retrieving the uid of the desired Tenant, tho I'd say it's still manageable.

[msergg]

I prepared short script to assign ns to tenant

to use as
python3 attach_to_tenant.py <tenant_name> | kubectl apply -f -

# Usage example
# python3 attach_to_tenant.py <namespace> <tenant_name> | kubectl apply -f -

import sys
import yaml
import subprocess

# Get input options for script
try:
    namespace = sys.argv[1]
except IndexError:
    print("Namespace name was not delcared!")
    exit(1)

try:
    tenant_name = sys.argv[2]
except IndexError:
    print("Tennant name was not delcared!")
    exit(1)


# Get namespace yaml definition
p = subprocess.run(
    ["kubectl", "get", "ns", namespace, "-o", "yaml"],
    capture_output=True,
    text=True,
)
ns_yaml = p.stdout


# Get tenant yaml definition to get uid
p = subprocess.run(
    ["kubectl", "get", "tenant", tenant_name, "-o", "yaml"],
    capture_output=True,
    text=True,
)
tenant_yaml_str = p.stdout
tenant_parsed = yaml.safe_load(tenant_yaml_str)
tenant_uid = tenant_parsed["metadata"]["uid"]


ns_parsed = yaml.safe_load(ns_yaml)

ns_parsed["metadata"]["labels"]["capsule.clastix.io/tenant"] = tenant_name

owner_ref = {
    "apiVersion": "capsule.clastix.io/v1beta2",
    "kind": "Tenant",
    "name": tenant_name,
    "uid": tenant_uid,
    "controller": True,
    "blockOwnerDeletion": True,
}

ns_parsed["metadata"]["ownerReferences"] = [owner_ref]

result_yaml_ns = yaml.dump(ns_parsed)
print(result_yaml_ns)

[msergg]

this action was done by administrator, that why tried to find the reason

[prometherion]

It seems weird to me since I'm the cluster administrator here.

$: cat <<EOF | k apply -f -
apiVersion: capsule.clastix.io/v1beta2
kind: Tenant
metadata:
  name: test
spec:
  owners:
  - kind: User
    name: alice
EOF
tenant.capsule.clastix.io/test created

$: kubectl --as alice --as-group capsule.clastix.io create ns test-dev
namespace/test-dev created

$: kubectl --as alice --as-group capsule.clastix.io edit ns test-dev
error: namespaces "test-dev" could not be patched: admission webhook "owner.namespace.capsule.clastix.io" denied the request: the OwnerReference cannot be removed

$: kubectl edit ns test-dev  # the admin user
namespace/test-dev edited

$: kubectl get tnt
NAME   STATE    NAMESPACE QUOTA   NAMESPACE COUNT   NODE SELECTOR   AGE
test   Active                     0                                 4m16s

[msergg]

I`ll check one more time, thanks for you answer

[msergg]

Tried to remove reference by administartor
by get admission webhook errror

Error from server: error when applying patch:
{"metadata":{"annotations":{"kubectl.kubernetes.io/last-applied-configuration":"{\"apiVersion\":\"v1\",\"kind\":\"Namespace\",\"metadata\":{\"annotations\":{\"cattle.io/status\":\"{\\\"Conditions\\\":[{\\\"Type\\\":\\\"ResourceQuotaInit\\\",\\\"Status\\\":\\\"True\\\",\\\"Message\\\":\\\"\\\",\\\"LastUpdateTime\\\":\\\"2023-06-21T11:23:17Z\\\"},{\\\"Type\\\":\\\"InitialRolesPopulated\\\",\\\"Status\\\":\\\"True\\\",\\\"Message\\\":\\\"\\\",\\\"LastUpdateTime\\\":\\\"2023-06-21T11:23:18Z\\\"}]}\",\"lifecycle.cattle.io/create.namespace-auth\":\"true\"},\"creationTimestamp\":\"2023-06-21T11:23:16Z\",\"finalizers\":[\"controller.cattle.io/namespace-auth\"],\"labels\":{\"kubernetes.io/metadata.name\":\"karpenter\",\"name\":\"karpenter\"},\"name\":\"karpenter\",\"resourceVersion\":\"369144689\",\"uid\":\"4da86591-9b5e-4617-9951-611fa3852ec4\"},\"spec\":{\"finalizers\":[\"kubernetes\"]},\"status\":{\"phase\":\"Active\"}}\n"},"labels":{"capsule.clastix.io/tenant":null},"ownerReferences":null}}
to:
Resource: "/v1, Resource=namespaces", GroupVersionKind: "/v1, Kind=Namespace"
Name: "karpenter", Namespace: ""
for: "STDIN": admission webhook "owner.namespace.capsule.clastix.io" denied the request: the OwnerReference cannot be removed

any ideas?

[prometherion]

Could it be related to the issue reported #733?

It has been addressed with v0.3.1, I didn't ask you which version of Capsule are you running on.